Loading story…
VideoLAN released VLC Media Player 3.0.24, remediating more than 130 security flaws across VLC and its bundled components. The update refreshes 49 third-party libraries, most notably replacing the embedded FFmpeg 4.4 branch with FFmpeg 8.1.2; one report attributes 49 fixed vulnerabilities directly to the VLC release. Users should update promptly, while detailed vulnerability advisories are expected on VideoLAN's security page.
The release also adds ATRAC3/ATRAC9 audio decoding, APV video support, CEA-708 captions, improved MP4 and MPEG transport-stream metadata handling, SFTP public-key authentication, SMB2 support, and SRT listener-mode socket reuse. It further fixes Windows startup delays associated with daylight-saving-time changes, Direct3D11 rendering problems, Windows audio crashes, and AudioToolbox MIDI-synthesizer crashes on macOS 26 and later.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
VideoLAN released VLC 3.0.24, updating 49 bundled third-party libraries, including FFmpeg from the 4.4 branch to 8.1.2. The release remediates more than 130 vulnerabilities across VLC and bundled libraries, while one report identifies 49 vulnerabilities fixed in VLC itself.
VLC 3.0.23 was released in January and fixed vulnerabilities involving the processing of various media formats.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
heise.de
Open sourceopennet.ru
Open sourcevideolan.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two vulnerabilities affecting VLC Media Player versions `3.0.0` through `3.0.23` allow attacker-controlled media content to corrupt heap memory or expose client memory. High-severity `CVE-2026-56711`, discovered by Fabian Wahle of Hap Security, is an integer-overflow and out-of-bounds-write flaw in picture-buffer allocation that can be triggered with an oversized crafted PNG image; successful exploitation may lead to heap corruption and potentially code execution. Medium-severity `CVE-2026-73324` affects RTSP response parsing: a malicious RTSP server, including one reached through a crafted playlist, can provide an overlong `Session` header and retrieve adjacent heap memory. VideoLAN and distribution maintainers had not yet provided patched releases, so users should avoid untrusted PNG files, playlists, and RTSP streams; organizations should limit VLC use in high-risk workflows and block untrusted RTSP connections where practical.
Sep 14, 2026
An autonomous security agent developed by **depthfirst** uncovered **21 previously unknown zero-day vulnerabilities** in **FFmpeg**, the widely used open-source media processing library embedded in browsers, streaming services, surveillance products, and cloud workloads. Reported flaws span the TS demuxer, VP9 decoder, RTP depacketizers, RTSP server, and RTMP client, with multiple memory-corruption bugs and at least eight assigned CVEs. The most severe issue, **`DFVULN-127`**, is a heap buffer overflow in FFmpeg’s AV1 RTP depacketizer that researchers said could enable **remote code execution** through a single **183-byte RTP packet** delivered over RTSP, without authentication or user interaction. The FFmpeg findings were disclosed alongside **Chrome 149**, which fixed a record **429 vulnerabilities**, including more than **100 critical or high-severity flaws** and a severe **ANGLE** issue tracked as **`CVE-2026-10881`** with a **CVSS 9.6** score. Researchers said the FFmpeg bugs were found after an AI agent scanned roughly **1.5 million lines of C code**, performed threat modeling, reachability analysis, and proof-of-concept generation, reportedly at a cost of about **$1,000**. The disclosures add to evidence that AI is sharply increasing the speed and volume of vulnerability discovery, while leaving defenders and maintainers under growing pressure to triage findings, patch exposed software, and review network-facing workflows that process untrusted **RTSP/RTP** media streams.
Jun 29, 2026
FFmpeg patched **CVE-2026-8461**, a high-severity heap out-of-bounds write flaw dubbed **PixelSmash** in the `libavcodec` **MagicYUV** decoder. The bug is triggered by an odd `slice_height` condition while parsing malicious **AVI**, **MKV**, or **MOV** files and affects FFmpeg versions before **8.1.2**. The vulnerability can cause denial of service and, in some environments, lead to remote code execution. JFrog reported that applications embedding FFmpeg are exposed through their media-processing pipelines, and demonstrated full remote code execution against **Jellyfin 10.11.9** via its automated media library scan workflow, although successful RCE required **ASLR** to be disabled or bypassed. **Nextcloud** was also identified as potentially vulnerable under additional conditions, while **Plex** appears largely protected by a restricted custom FFmpeg build. Organizations using FFmpeg directly or through downstream products have been urged to upgrade to **FFmpeg 8.1.2 or later** and apply vendor patches because the decoder’s broad adoption creates a notable supply-chain exposure.
Jul 30, 2026